New Member

Question

Proxy/Redirected FQDN

Forum|Forum|2 years ago
July 25, 2023
3 replies
5192 views

Hi folks,

Looking for some advice here. We have an access control system off-site (no Forti equipment) that sits behind what appears to be a "proxy" FQDN. LAN -> WAN -> URL -> Redirected IP/port -> ACS.

Every time the URL is accessed, it will redirect to a new IP and port combination - what I imagine is some kind of load-balancing. I can whitelist the redirected IP and the port, but it changes after a day or so. Efforts to glean the IP/port ranges I need to whitelist have been futile.

Is there a way to whitelist a FQDN's redirections? I port forwarded a customized port on the ISP router to the private IP of the ACS interface in the past (by being there physically)...but this WAN IP has changed - and I'm looking for a way to allow access remotely.

Am I overthinking it? Thanks for your thoughts!

FortiGate

saneeshpv_FTNT

Staff

Hi

Not very clear with your setup. Could you please share the URL you are accessing? Is it publicly accessible? Where is this redirected IP/port pointing to ? Also where is the FortiGate placed in this traffic path ?

Maybe a diagram would help.

Best Regards,

A

Anonymous_User

Contributor III

Hi Team,

Please share us the below details.

Is firewall acting as a proxy server or are you using any third party proxy ?

please share us the clear network diagram and proxy configuration settings on the user PC accessing the URL mentioning the URL you are accessing.
Also please let us know the exact requirement you are looking for by explaining in detail.

MidwestOpeAuthor

New Member

The FortiGate 60F is doing nothing special, just forwarding requests on as necessary. There seems to be a 3rd party proxy down the line, as seen in the diagram provided.

I'm looking to see if I can whitelist or "trust" the redirected IP/Port combination after hitting the initial URL. The proxy server uses different ports and IPs after a certain period of time, like 24 hours. I can whitelist the URL, but it seems FortiGate doesn't allow for access after it is redirected. I can provide the URL in a private message if necessary....

MidwestOpeAuthor

New Member

Yeah, it's real funky. I'm going to try and attach a video of what I'm seeing. The "proxy" is essentially a load balanced black box it seems that redirects to the ACS...somewhow.

I've taken to going to the location physically and logging in to port forward certain requests to the ACS. But, it'd be nice to get this functionality working without having to whitelist the whole internet (because the IP/port combo changes so frequently).

saneeshpv_FTNT

Staff

Hi @MidwestOpe@MidwestOpe ,

From the video, it looks like when you access the RMC URL, the device on the other end is redirecting the user to this IP/Port and the subsequent request to this IP/port is being either blocked at your Fortigate (as you may not allow allow random ports to Untrust/Internet) or this request black holed some where. Please check fortigate logs for any traffic block for this IP or Port. If it does please try to create a Policy in FGT for testing with Destination and Service as "all".

Are you aware of this IP address (185.202.172.220) ? Also Please also confirm if there is any proxy in your local network.

Best Regards,

MidwestOpeAuthor

New Member

Yes, it's being blocked in the FortiGate and I can whitelist it - but a few hours later this IP/port combo will change requiring me to re-whitelist a new IP/port combo. That's the issue. After I'm redirected at the RMC URL, the firewall treats the new IP/port combo as a new FortiGate request, and no rules match so implicit deny is used.

Lepoevin

New Member

I had the same thing happen and fixed it by adding the resolved IP directly to the policy after checking the DNS log for what FQDN it turned into.

Sign up

Login with SSO

Login to the community

Login with SSO